Splunk® Enterprise

Splunk Analytics for Hadoop

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Set up your search head instance

Splunk Analytics for Hadoop reaches End of Life on January 31, 2025.

After you install Splunk Enterprise and license Splunk Analytics for Hadoop, configure a search head to support the providers and virtual indexes you will add later.

See Set up a provider and virtual index for more information about configuring providers and virtual indexes.

1. Keep a copy of the .tgz version of Splunk Enterprise on your search head (you need this package even after installing it on the search head).

During the first virtual index search, Splunk Analytics for Hadoop copies this package to HDFS then extracts it into all TaskTracker nodes that participate in the search. The extracted package is used to process search results in Hadoop.

If you have already installed a Linux version of Splunk Enterprise using a download other than the .tgz, download a copy of the splunk_package.tgz file to install on your search head.

2. If you have not done so already, install Java on the search head. You need this to access the Hadoop cluster.

3. Install the Hadoop client libraries on your search head. The client libraries must be the same Hadoop distribution and version as your Hadoop cluster. To communicate with multiple Hadoop clusters of differing distributions and versions, install the Hadoop CLI package for each distribution on the search head.

Last modified on 30 October, 2023
PREVIOUS
Install Splunk to use Splunk Analytics for Hadoop
  NEXT
Upgrade your search head for Splunk Analytics for Hadoop

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters